Case Study: Parma Calcio Internal Operations Platform

Parma Calcio 1913 - a modern internal platform to streamline day‑to‑day operations across analysis, coaching, and administrative teams. The legacy version made it difficult to share updated documents and training videos quickly, and manual workflows caused duplicate data entry.

• Single source of truth for staff documentation and media
• Fast, reliable delivery of large assets globally to traveling staff
• Role‑based access with auditability
• Automation to reduce repetitive admin work

1. API layer for workflows (requests, approvals, notifications)
2. PostgreSQL for transactional data with RLS‑style constraints implemented at the app tier
3. Amazon S3 for documents and training videos, private buckets
4. CloudFront distribution with Origin Access Control (OAC) for secure edge delivery
5. Pre‑signed URLs for controlled uploads and time‑boxed downloads

Sensitive endpoints and buckets are private by default; access is enforced via signed requests, least‑privilege IAM, and OAC policies. Public URLs are never exposed for private media.

• Edge‑cached documents and videos with sensible cache policies (immutable versioned keys, short TTL for listings). P95 video start time under 1.2s for common assets.
• Workflow automation (request → approve → notify) that reduced manual copy/paste and status chasing.
• Role‑based access control (RBAC) and audit trails for sensitive content.
• Pre‑signed uploads for staff to contribute assets securely without direct S3 credentials.
• Responsive UI components and dashboards with 95+ Lighthouse performance on internal networks.

Secure media delivery without public buckets

I enforced private S3 buckets with CloudFront OAC and restrictive bucket policies, ensuring media is only accessible via CloudFront. Time‑boxed access was provided with pre‑signed URLs for specific roles.

Keeping caches hot while content changes

I used versioned keys for immutable assets and scoped CloudFront invalidations for listings and manifests. This minimized invalidation costs while guaranteeing fresh content.

Balancing performance with governance

RBAC and audit logs were integrated without adding friction. Defaults were secure and opt‑in permissions were visible and reversible.